Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

HTTP Error: 403, The caller does not have permission (when updating Node.js runtime)

See original GitHub issue

[REQUIRED] Environment info

firebase-tools: 8.4.0

Platform: Windows

[REQUIRED] Test case

When attempting to deploy functions using firebase deploy --only functions I get the following error: Error: HTTP Error: 403, The caller does not have permission

The only change that has been made was changing the node engine in package.json from 8 to 10. Changing back to 8, and the functions successfully deploy, so it seems like I don’t have permission to update the node runtime. See below for more details.

[REQUIRED] Steps to reproduce

Authorization Have the following permissions:

Firebase Admin
Service Account User (Set via google cloud console)

Preconditions

Have firebase functions already deployed
package.json contains the following entry:

{
   "engines": {
       "node": "8"
   }
}

have {“node”: “8”}

Steps

Run firebase deploy --only functions
Functions deploy successfully as expected
Update the node runtime from 8 to 10 in package.json like so:

{
   "engines": {
       "node": "10"
   }
}

Attempt to deploy functions by running firebase deploy --only functions

[REQUIRED] Expected behavior

Node runtime is updated from 8 to 10
Functions are successfully deployed.

[REQUIRED] Actual behavior

Without --debug flag

With --debug flag

[2020-05-26T16:38:12.318Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
[2020-05-26T16:38:12.321Z] > authorizing via signed-in user
[2020-05-26T16:38:12.321Z] [iam] checking project PROJECT_NAME for permissions ["cloudfunctions.functions.create","cloudfunctions.functions.delete","cloudfunctions.functions.get","cloudfunctions.functions.list","cloudfunctions.functions.update","cloudfunctions.operations.get","firebase.projects.get"]
[2020-05-26T16:38:12.326Z] >>> HTTP REQUEST POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_NAME:testIamPermissions
 {"permissions":["cloudfunctions.functions.create","cloudfunctions.functions.delete","cloudfunctions.functions.get","cloudfunctions.functions.list","cloudfunctions.functions.update","cloudfunctions.operations.get","firebase.projects.get"]}
[2020-05-26T16:38:12.534Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Tue, 26 May 2020 16:38:11 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","server-timing":"gfet4t7; dur=63","alt-svc":"h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
[2020-05-26T16:38:12.537Z] >>> HTTP REQUEST POST https://iam.googleapis.com/v1/projects/PROJECT_NAME/serviceAccounts/PROJECT_NAME@appspot.gserviceaccount.com:testIamPermissions
 {"permissions":["iam.serviceAccounts.actAs"]}
[2020-05-26T16:38:12.710Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Tue, 26 May 2020 16:38:12 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}

=== Deploying to 'PROJECT_NAME'...

i  deploying functions
+  functions: Finished running predeploy script.
[2020-05-26T16:38:17.803Z] > [functions] package.json contents: {
  "name": "functions",
  "description": "Cloud Functions for Firebase",
  "dependencies": {
    "axios": "^0.19.2",
    "babel-runtime": "^6.26.0",
    "camelcase": "^5.3.1",
    "child-process-promise": "^2.2.1",
    "firebase-admin": "^8.9.2",
    "firebase-function-tools": "^1.1.3",
    "firebase-functions": "^3.6.1",
    "glob": "^7.1.6",
    "mkdirp-promise": "^5.0.1",
    "moment": "^2.24.0",
    "node-fetch": "^2.6.0",
    "nodemailer": "^6.4.2",
    "request": "^2.88.0",
    "request-promise": "^4.2.5",
    "uuid": "^3.4.0"
  },
  "engines": {
    "node": "10"
  },
  "private": true,
  "scripts": {
    "check": "npm-check -s -u",
    "deploy": "firebase deploy --only functions",
    "lint": "eslint .",
    "logs": "firebase functions:log",
    "serve": "firebase serve --only functions",
    "shell": "firebase functions:shell",
    "start": "npm run shell",
    "test": "mocha --reporter spec --exit"
  },
  "devDependencies": {
    "chai": "^4.2.0",
    "chai-as-promised": "^7.1.1",
    "eslint": "^6.8.0",
    "eslint-plugin-promise": "^4.2.1",
    "firebase-functions-test": "^0.1.7",
    "mocha": "^7.0.1",
    "sinon": "^8.1.1"
  }
}
i  functions: ensuring required API cloudfunctions.googleapis.com is enabled...
[2020-05-26T16:38:21.645Z] [functions] runtime dependency check dates: warning: 2020-05-21T00:00:00.000Z error: 2020-06-23T00:00:00.000Z
i  functions: ensuring required API cloudbuild.googleapis.com is enabled...
[2020-05-26T16:38:21.647Z] >>> HTTP REQUEST GET https://serviceusage.googleapis.com/v1/projects/PROJECT_NAME/services/cloudfunctions.googleapis.com

[2020-05-26T16:38:21.648Z] >>> HTTP REQUEST GET https://serviceusage.googleapis.com/v1/projects/PROJECT_NAME/services/runtimeconfig.googleapis.com

[2020-05-26T16:38:21.649Z] >>> HTTP REQUEST GET https://serviceusage.googleapis.com/v1/projects/PROJECT_NAME/services/cloudbuild.googleapis.com

[2020-05-26T16:38:22.086Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Tue, 26 May 2020 16:38:21 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
[2020-05-26T16:38:22.093Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Tue, 26 May 2020 16:38:21 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
!  functions: missing required API cloudbuild.googleapis.com. Enabling now...
[2020-05-26T16:38:22.095Z] >>> HTTP REQUEST POST https://serviceusage.googleapis.com/v1/projects/PROJECT_NAME/services/cloudbuild.googleapis.com:enable

[2020-05-26T16:38:22.137Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Tue, 26 May 2020 16:38:21 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
+  functions: required API cloudfunctions.googleapis.com is enabled
[2020-05-26T16:38:22.572Z] <<< HTTP RESPONSE 403 {"vary":"X-Origin, Referer, Origin,Accept-Encoding","content-type":"application/json; charset=UTF-8","date":"Tue, 26 May 2020 16:38:21 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"","accept-ranges":"none","transfer-encoding":"chunked"}
[2020-05-26T16:38:22.573Z] <<< HTTP RESPONSE BODY {"error":{"code":403,"message":"The caller does not have permission","status":"PERMISSION_DENIED"}}

Error: HTTP Error: 403, The caller does not have permission
[2020-05-26T16:38:22.577Z] Error Context: {
  "body": {
    "error": {
      "code": 403,
      "message": "The caller does not have permission",
      "status": "PERMISSION_DENIED"
    }
  },
  "response": {
    "statusCode": 403,
    "body": {
      "error": {
        "code": 403,
        "message": "The caller does not have permission",
        "status": "PERMISSION_DENIED"
      }
    },
    "headers": {
      "vary": "X-Origin, Referer, Origin,Accept-Encoding",
      "content-type": "application/json; charset=UTF-8",
      "date": "Tue, 26 May 2020 16:38:21 GMT",
      "server": "ESF",
      "cache-control": "private",
      "x-xss-protection": "0",
      "x-frame-options": "SAMEORIGIN",
      "x-content-type-options": "nosniff",
      "alt-svc": "h3-27=\":443\"; ma=2592000,h3-25=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"",
      "accept-ranges": "none",
      "transfer-encoding": "chunked"
    },
    "request": {
      "uri": {
        "protocol": "https:",
        "slashes": true,
        "auth": null,
        "host": "serviceusage.googleapis.com",
        "port": 443,
        "hostname": "serviceusage.googleapis.com",
        "hash": null,
        "search": null,
        "query": null,
        "pathname": "/v1/projects/PROJECT_NAME/services/cloudbuild.googleapis.com:enable",
        "path": "/v1/projects/PROJECT_NAME/services/cloudbuild.googleapis.com:enable",
        "href": "https://serviceusage.googleapis.com/v1/projects/PROJECT_NAME/services/cloudbuild.googleapis.com:enable"
      },
      "method": "POST"
    }
  }
}

Having trouble? Try firebase [command] --help